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The  use  of  artificial  in  tel  1 iperiee  methods  in  on  airborne 
computer  system  can  enhance  flipht  safety  hy  rpduci np  the 
possibility  of  pilot  error  caused  hy  inadenuate  or  misleading 
information.  The  intelligent  computer  syst.em  would  have  the 
ability  to  screen  information  for  relevancy  to  the  current 
situat  ion.  The  selection  of  information  reauires  know 1 ode  e ot 
t tie  context  which  may  depend  upon  the  phase  of  fl  ioht  , t ho 
condition  of  the  aircraft  , or  external  factors.  The 
phase-based  context  mipht  he  represented  by  scripts.  The 
cond i tion-hnsed  and  the  external  context  can  be  represented  hy 


a enuse-r 


fleet  net.  Knowledge  of  cord  ext  will  not  only  enahl 


priority  resolution  of  information,  but  also  definit  ion  of 
I'on  I ,s  for  pen  or  at  inf  plans  to  cope  with  abnormal  situat  ions. 
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The  rssont  ini  attribute  of  np  intelligent  airborne 
coni  put  or  system  will  be  it?  ability  l o provide  information 
whiob  will  help  the  pilot  "stay  ahead  of  the  aircraft”.  1 ho 
better  t h o pilot,  con  anticipate  the  future  state  of  the 
aircraft  , the  better  he  can  make  pood , safe  decisions 
eorteerninp  the  operation  of  the  aircraft. 

1 . 1 Kot i vat  i on 

This  paper  presents  an  analysis  of  the  functions  of  an 
advanced  airborne  computer  system  which  utilizes  artificial 
intelligence  (AI)  techniques.  The  airborne  npnlicat  ion  was 
selected  because  it  represents  a very  specific'  and  limited 
domain,  yet  is  still  rich  enouph  to  provide  a meaninpful 
application.  Furthermore,  there  is  potential  for  immediate 
p r a e t i o a 1 a p p 1 i c a t i o ti . 

The  safe  operation  of  a modern  aircraft  depends  pr in  aril 
upon  the  pilot's  performance.  It  is  believed  that  the  pilot  ' 
performance  can  be  improved  and  flirbt  safety  eat'  be  enhanced 
i'\  an  advanced  computer  system  that  provides  relevant 
it.  fort’  at  i on  t v the  pilot  on  a real-time  basis.  The  primary 
object  i vc  is  to  prevent  errors  that  are  caused  hv  tin'  pilot 
takinp  at  improper  ciMirse  of  action  because  of  inadeouato  or 
misleading  in  format  ion . As  aircraft  become  more  reli  >ble,  1 b 
eorrespondinp  experience  level  of  pilots  poos  down  because 
fewer  experience  actual  d i f f i on  1 1 i os . !‘  is  not  uncommon  for 
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xporienced  on  actual  onritio  failure.  At  1 ho  sane 
reasinp  complexity  of  aircraft  furtf'er  nppravatos  t 
. Hence,  it  would  hi  ad v an  1 as  eons  I e util  i n the 
r svst.em  knowledge  base  to  supplement  'lie  pi  Kit's 
non.  A r ed  no t i on  in  peak  workload  would  he  benefit 
accidents  ore  frequently  assoc  i oteo  wit  h liiph  Wv'nl 
o r>  s . 


■ i t or i a 

survey  I'  v the  I ,oo  1:  eed  fa  I i 1 or  n i u f oil’  p.  ■ n v 171  o I 1 >t 1 1 
resulted  i •'  the  following  criteria  for  an  informal 

Information  should  help  keep  t hi'  pilot  thinkinr 
ah, cad  of  the  current  state  of  the  aircraft. 

Visual  displays  are  preferred  for  reccivinp 
i n format,  i op  and  color  is  hen  e f i o i a 1 . 

Displays  should  answer  the  followinp,  uucstions: 

!.  "How  am  1 doinpV" 

. . "How  we  1 1 atr  1 do  i nr  7 " 

% . "What  "tivui  1 d I he  do  i tip  V" 

v l>e  com  pat  ihle  with  t lie  pilot  . the  eernpui  er  system 
not  increase  the  workload  of  the  pilot  . The  oonpn 
should  act  like  an  add  i t i or  al  , b i r :h  1 v- 1 r a i red 
I'cr  wlu's.e  primary  task  is  to  assi-t  1 te  pilot  . l'b 
■t  an v kind  of  assistance  is  diminished  if  it  Kiere 
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of  the  data  t h n t the  computer  system  pr  csen  i s t e him.  t-arl  i 
information  systems  like  the  Hue  hes  Vast  or  fonitor  hi  ••pi  v 
f 10]  and  the  Poe  i nr  Tn  t or .r  a t ed  Information  Present  at  ion  and 
Coni  t\>  1 y s.  t e»t  ( l ! I'  ACS  1 1 1 I did  net  a 1 t err  p t to  an  . ■ 1 v .•  e if.-  r 
dat;  ter  re! rvpnoy  end  suffered  from  on  i n format i on  rlut  . 

l'he  A I .'ippr'oaoh  tv'  t he  prv'hlep-  is  tv'  use  the  • • ' cuter  t 
soreer  the  lata  and  present  the  informal  ion  which  is  relevan 
tv'  the  situation  in  order  of  priority.  The  screen  inp  implie 
s priv'rity  :'d  nu't  lire  which  must  hi'  sens,  if  i ve  to  the  c oners  1 
state  or  context  of  the  aircraft  and  its  environment.  In 
odd  it  ien,  the  intellipent  onhoarvl  computer  should  ease  tie 
problem  sol  vine  task  of  the  pilot  by  providing  necessary 
p roood  nr-  a 1 in  format  i v'n  . The  cornput  er  svst  cm  cart  flirt  her 
reduce  the  pilot's  workload  hy  exeoutinr  tasks.  d«' legated  to 
it.  Other  tasks  could  include  automatie  rrnrtion  t o>  rertni  n 
ein'iT  eiirv  conditions.  Karlicr  work  in  this  area  resulted  in 
computer  aided  decision  makinc  svst  cm  (OAPN’l  I '1  which 
defected  .and  corrected  failures  in  eleelrieal  and  fuel 
systems.  refection  was  done  by  usinr  data  driven  prorrams  v' 
PF>!f'P.c.  A I'P'iOM  is  a propram  that  is  >etivated  when  s.pccif  i 
data  is  received.  The  data  could  be  sensor  values,  time,  or 
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The  1 irit.nl  Avionics  1 ti  format  i on  System  (IATS)  I 1 
represents  a s i p n i f i c nn  t ster>  toward  an  ndvnnoed  computer 
system.  The  f A I ' • desire 

!.  reeorpises  the  importance  of  o f u 1 1 v integrated 
computer  system  in  advanced  niroraft  . 

?.  attempts  to  tailor  computer  operation  to 

different  phases  of  flipht  by  select. ire  the 
appropriate  faster  *'orio, 

and  attempts  to  control  pilot  workload  and  treat 
the  pilot  as  a manarer  rather  than  as  a slave  to 
t h e com p u t. o r s y s t cm  . 

However,  PAIS  depends  upon  the  pilot  to  chanpe  the  Paster  ,'ode 
and  to  make  inputs  which  mipht  not  be  necessary  if  more 
complete  context  information  were  available. 

This  paper  will  review  two  fu'v^misinp  methods  for 
re  presen  t.i  np  different  types  of  cont.exl  information.  There 
seem  to  be  three  types  of  context.  One  type  of  context  is  the 
phase-based  context  which  is  of  a temporal  nature.  II 
riHTi'i’*  how  and  when  systems  ehanpe  durinr  different  phase", 
of  the  fl.iPht  . A promisinc  method  of  represent i nr  phase-based 
context  is  the  script  concept  of  Schank  and  Abelsor  ( th],  The 
scripts  provide  the  normal  bnckpround  information  for  each 
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: ■ , .. • 1 ns  a rneobar  sm  for  nnt.icip  ^ 1 i 1 1 s t . ■ • • - 

of  the  a i v o r a f t . 

Another  type  of  context  is  cond  it  iot  -t  1 sed  cer  text  . It 
i s I or  pel  v aircraft  ind  sv-t  ei"  do  per  it  < n t , ate  it  docs  not 
o 'or.’  e for  a river  aircraft  , Tti  i s would  include  information 
or.  ■■licit  i tems  or  fuel  system  manap.enept  , hydraul  i c red  urn)  one  v 
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A 1 r o r i t h m ; 1 < , 1 :i  1 . 


file  basic  components  which  an  intelligent  comput  er  sente"1 
shonlo  possess  ir.'ln'e  a monitor,  a plan  rororotor,  an 
executive,  and  a knowlepe  base.  The  knowledge  base  would  be 
common  to  all  components.  Control  would  be  sem i - out oromous 
with  the  executive  providinr  the  hirh  level  directives  and  the 
monitor  and  plan  generator  capable  of  rerforminr  its  funet  ion 
independently.  Pipiire  1 depicts  the  arranrement  of  the 
component  .,  with  o common  bus  for  oonmunioat  ions. 
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F ip  lire  1 Genera]  Orpanizatior 

It  is  apparent  that  the  intelligent  computer  system  mu 
l e hif’hlv  reliable  since  false  alarms  o r undetected  devial  i 
could  he  ri isnsterous  or  rt  least  sipn: f i can t 1 v lessen  the 
value  of  tie  computer  system.  It  nurt  ut  Mice  extensive 
e 1 f - t e •;  t,  i np  , error  (\irrrct  ion,  redundancy,  and  he  , h 1 e to 
operate  in  a depended  mode.  The  system  must  he  desirned  to 
fail  rrndually  rather  than  suddenly  and  without  wnrnine. 
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ropd  i r.r  . The  conplrte  5et  of  ppr.'n  i't  rrr  would  »'o  avail  ; Me  t o 
t hr  p i ! c t.  or  rp.Hipf.t  or  automat  icrl  1 y when  reeled  . 

It  is  iTnerpl  1 v acknowledrrd  Mat  certain  phase?  r !' 
t 1 j ,zht  u'c  character-  i rpd  hy  a hirh  workload  for  tl  r pilot  Mid 
crew.  Puriur  hirh  workload  periods,  the  ouMitv  nr.  < mi  anti  tv 
of  the  normal  non  i tor  inp  is  likely  to  he  diminished, 
i aviations  are  more  likely  t.o  p o undetected  for  lonper  periods 
of  t i me  . Art  unnoticed  dr  v i at  i or  ear  t re  merit  1 v compound  tie 
hazard  ot  ;•  hip h workload  situat  ion.  The  monitor  would  not  he 
affected  hv  the  increased  workload  since  it  will  he  designed 
t.o  have  excess  capacity  over  peak  load  sit  unt  ions . >!or  would 
the  nor i tor  he  affected  hv  typical  human  fail inns  such  as 
boredom,  fat i rue,  or  fixation. 
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The  intelligent  monitor  would  require  several  supporting 
functions.  The  capabilities  for  the  monitor  should  include 
the  following: 


1.  Verification  of  sensor  output. 

2 . retention  of  deviations. 

3.  Diagnosis  of  a common  cause  for  related  sensor 
indications. 

A.  Reporting  diagnosis  to  the  executive  for 
priority  resolution. 

G . Automatic  checklist  presentation. 

h.  Generation  of  a history  of  deviations  and 
significant  events  for  later  analysis. 

7.  Real-time  response 

8.  Degraded  mode  operation 


The  basic  sequence  of  operations  for  the  monitor  should 


probably  follow  the  steps  below. 


1.  Fensors  provide  direct  information  about  the 
state  of  the  aircraft  and  its  systems.  All 
significant,  measurable  parameters  are  sensed. 

?.  The  sensor  readings  are  verified  for  logical 

consistency.  Any  sensor  indication  which  is  not 
consistent  is  given  a lower  plausibility  and  is 
so  reported. 

3.  The  verified  sensor  readings  are  compared 

against  n context  sensitive  model  for  agreement. 

A.  A diagnosis  is  made  hased  upon  the  deviations  to 
determine  if  there  is  a probable  common  cause. 

r>.  Any  diagnosis  and  the  supporting  evidence 
(sensor  indications)  are  reported  to  the 
executive  for  relay  to  the  pilot  and  recorded 
for  later  analysis. 
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Sensor  Vor  i f i eot  i on 
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ch;>i. po.  The  indiented  quantity  of’  fuel  would  also  he  comp. in  d 
apnirist  the  planned  quantity  I'rotn  the  flipht  plan. 

T . 1 . < H y <i r- : f u 1 i o Pressure 

The  hydraulic  pressure  is  n measure  of  the  per  formnner  o( 
tin'  hydraulic  pumps.  pc  ] a t ed  sensor;;  include  h v<!  r hi  1 i c fluid 
quantity,  hydraulic  pump  rpm.  fluid  temperature,  and 
ficcumul  "itor  pres;. lire.  Sensors  which  direct  lv  report  t he 
resultiint  not  ion  of  hydraulic  |'ri's:  ure  nre  also  necessnrv. 

' 

Titese  would  include  flipht  ivnl  rol  sort  ice  posit  ion 
indicators,  other  h vd  r ou  I i o o 1 1 y net  noted  in  ee  ho  n t sr  position 
i ml  i ent or s . 

. . 1 . h [ nor  t i n 1 Plot  form 

1 he  ver  i f i eot  i on  v' t this  type  ol  sensor  is-  a prrld  em 
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upon  the  aircraft  : lilt,  Imp,  weight  , and  thrust..  I.ift  is  . 
t'nnet  ion  of  triple  of  attack,  a i r .speed  , and  eonfipurnt  ion  . 

Prop  also  ilcptunl  on  the  prune  poromet  prs . Thru.sl  in  simply 
the  effective  thrust  of  t tie  enpines.  Weipht  is  the  effective 
weirhl  o f the  nine  reft  (takes  Cl-londinp  into  neeoutit  ) . The 
ii  lit’  1 e of  , 1 1 t .10 1;  nint  the  pitot-  s t n I i 0 <1  n 1 ,1  eon  he  eo  r re  1 o t eil 

Kit  1 1 od  (I  i t i on  o 1 hot  ; 1 shout  t tie  en p i ne  t tin  ns  t , o i r e r o f t 

nci'el  ri'.it  ion  , o t t i t net  e , on  it  o i r e r 0 f t w<'  i p I' t . 

...  Pot  erin  i not  i on  of  t tie  Normal  Stole 

Ttie  normal  stote  of  .1  system  moy  depend  upon  t he  context 

of  t ii  ('  o i reran  . the  ph  n se  - ho  sed  eon  text  is  often  ref  1 eet  ed 

in  the  crew  checklist  where  different  modes  ore  speoifioed  fot 
different  phost's  o f flipht.  l-or  example,  durinp  landinr  end 
tokeoff  t tie  position  of  the  londitip.  peor  should  he  down  , hut 
durinp  cruise,  the  posit  ion  should  he  up  ond  locked.  besides 
con  fi  i'  norot  ion,  ot  her  examples  of  svst  etns  where  porometers  or< 
sensit  ive  to  the  phase  of  fl  ip, lit  ore  pressuricot  ion,  tin  fuel 
system,  ond  navipntion.  The  intellipent  compiit.er  system  eon 
detern  i tie  the  norinol  stote  of  sore  poraniet  ers  bv  the  use  of 
scripts.  Klipht  plan  information  vw  1 1 1 also  provide  reference 
information  on  planned  fuel  quantity,  route  of  flieht  , cruise 
speeds,  etc.  to  monitor  navi  pot  ion. 
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ponerat  .or  bus  l i c relay  should  bo  open.  !'  i mi  1 fir  1 y durinp  the 
transfer  of  fuel,  I bo  affected  valves  ;in<)  pump.*?  should  bo  open 
and  on,  respect, i vol y . 

factors  which  nro  external  to  t ho  aircraft  ."-nob  a a 
went  hrr  or  terrain  mav  also  have  an  affoct  upon  t.ho  normal 
state.  Pad  weather  often  call.*?  for  increased  safety  mrrpins. 
In  rusty  winds  or  suspected  wind-shear,  it  is  normal  to 
increase  airspeed  when  maneuver  inf  close  to  the  p round. 

I'rakinp  on  a wot  runway  will  not  provide  the  same  decolor  at  iot 
as  a dr'v  runway.  A wi't  runway  will  have  a eonsiderni  le  affect 
upon  (critical  enpino  failure  speed),  which  may  affoet  the 
r ecointieuded  procedures,  durinp  t hr*  loss  »■>  t an  onrino  on  tokooft 
roll. 

?.3  Piafnosis  of  Probable  Cause 

Often  a malfunction  will  cause  several  sensors  to 
indicate  a deviation.  It  is  therefore  essential  to  isolate 
the  cause  from  tho  symptoms.  A simple  example  of  diarnosis 
with  mult  iple  sensor  indications  is  an  enpine  flamoout  caused 
hy  a mal funct i on i np  fuel  boost  pump.  Within  a short  span  of 
time,  t lie  monitor  should  detect  fuol  pressure  low,  I ' I'M  low, 

1- (IT  low,  KPK  ) ow , associated  pencrator  out  put  off,  and  low 
hydraulic  pressure  on  the  associated  system.  A convent  tonal 
system  would  provide  the  pilot  with  every  sensor  indioat  ion 
and  depend  upon  1 he  pilot  and  his  experience  to  analyse  the 
data  and  draw  the  proper  conclusion. 
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represented  in  the  enmput.er  w i t h direct  ioral  link;;  hot  wo 
nodes.  Failure  ot  the  number  boost  pump  with  the  oros 
v.ilvi''  closed,  will  cause  fuel  pressure  t o <1rot',  whieh  in 
will  rotund  fuel  flow,  whieh  in  turn  will  enure  oomhurl i 
eeas.o.  Combust  ion  requires  the  r.  i mu  1 1 anoous  and  eont  inn 
exirtonee  of  not  only  fuel  flow,  hut.  also  air  flow  and 
i p. nit  ion.  Without  oomburt.ion,  the  engine  will  -.top  runn 
whieh  will  e.mr.t'  the  number  (’operator  ;im!  number  h v «! 
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cone  with  unusual  sifuat  ions. 
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'.H  Automatic  Chock  I i st 

Tho  purpose  o 1'  the  checklist  i ? to  insure  critical 
.lotion;;  arc  not  forgotten.  Human  1 i m i t a t.  i ons  nrrossitnt  r t hr 
t tie  checklist  procedures  t>o  brief  and  cover  onlv  the  most 
important  items.  Therefore,  t he  cm  is  si  or  of  anv  item  coul<1 
result  in  a hazardous  condition.  There  are  two  basic  types  c 
checklist  actions.  One  is  monitoring  and  the  other  is 
preparation.  The  former  is  well  handled  bv  the  baric  monitor 
The  latter  implies  more  planning  information. 

Th<  proparat ion  for  an  anticipated  maneuver  (e.p. 
larulim' ) nav  require  several  actions.  The  scrip!  can  provide 
informat  ion  on  what  actions  need  t o be  taken  t o prepare  for  ; 
maneuver.  The  preparations  include  aircraft  preparation  suci 
as  lower  inf,  the  landinp  pear,  hut  more  importantly,  pilot 
preparation.  The  pilot  would  he  posit  ively  notified  that  a 
specific  checklist  for  a portion  of  the  flipht  had  been 
success  f it  1 I v complete;).  For  example,  prior  to  the  approach  I 
1 and  i nr  the  display  miplit  appear  as  depicted  in  fi  pure  . 
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The  objective  of  the  plan  penerator  is  to  provide 
procedural  information  to  permit,  the  pilot  to  cope  with 
abnormal  situations  in  the  safest  possible  manner.  This  is 
accomplished  by  providing  the  necessary  information  on  a 
timely  basis.  The  normal  sentience  of  operation  for  the  plan 
generator  would  start  wi"h  a sipnal  from  the  monitor 
indicating  an  abnormal  condition  and  a diagnosis.  The  plan 
generator  would  then  provide  a canned  plan  from  its  stand. aril 
repertoire  or  generate  a new  plan.  The  primary  reason  for 
canned  plans  is  to  assure  minimum  reaction  time  to  abnormal 
conditions.  A canned  plan  mip.ht  result  in  the  use  of 
automatic  severity  abatement  procedures  to  further  reduce 
reaction  time  under  certain  well  defined  situations. 


The  peneral  guidelines  for  operation  dnrinp.  an  abnormal 
situation  applies  to  every  situation  in  any  type  of  aircraft. 
These  rules  are  as  follows: 


1.  Maintain  aircraft  control . 

This  means  that  the  priority  of  the  problem 
should  not  override  the  basic  "safety  of  flipht" 
rules.  Aircraft  control  should  not  be 
sacrificed  in  an  attempt  to  solve  a problem. 


? . Analyze  the  situation. 

The  pilot  and  the  monitor  must  collectively 
determine  the  cause  of  the  problem. 


1 F 


1 . Take  t he  pro per  art  ion. 

The  plan  generator  should  conn  up  with  a 
.'optionee  of  net  ions  that  will  correct  , or  at 
least  ameliorate  the  situation.  Failing  that, 
it  mipht  try  to  reperate  a plan  to  cope  with  the 
situation  until  a safe  laridinp  can  he  made. 

A . land  as  soon  as  conditions  permit. 

i.l  Automatic  Severity  Abatement  Procedures  (ASAP ) 

Certain  situations  become  prop ross  i vel  y worse  until 
corrective  action  is  taken.  The  purpose  of  ASAP  is  to  utilise 
t.  tie  speed  of  the  computer  to  limit  dam  ape  1 o the  aircraft  I ■ v 
rapid  response  to  time-cri tical  situations  by  automatical  1 v 
initiating  corrccti ve  action.  For  safety  reasons,  the 
computer  would  not  initiate  any  action  that,  was  irreversible. 
This  would  enable  the  pilot  to  override  any  ASAP  action. 

Tn  the  ease  of  an  enpine  fire,  it  is  desirable  to 
minimize  d am ap e to  the  aircraft  without,  increasinp  the  hazard 
to  the  crew  and  passenpors.  Shuttinp  down  the  enpine  would 
minimize  damap.e  to  the  enr  ine,  but  before  doinp  so,  the  system 
must  verify  that  the  thrust  remaininp  after  enpine  shutdown 
will  be  sufficient,  to  maintain  a safe  flipht  condition.  For 
example,  if  a three  enpine  aircraft  experiences  an  enr ine  fire 
while  flvinp  at  10,000'  001.  and  the  remaininp  two  enpinrs  were 
capable  of  maintaininp  the  current  flipht.  condition,  then  ASA1' 
would  automat i c a 1 1 y shutdown  the  affected  enpine.  In  another 


case,  a two  enrine  aircr?l  '•  on  final  approach  experiences  an 
ermine  fire.  Here,  if  the  remaininp  thrust  on  the  pood  enrine 
were  not  adequate  t.o  maintain  a safe  flipht  condition,  the 
enrine  would  not  be  automatically  shutdown  hv  ASAP  because 
do  i nr  so  could  increase  the  actual  hazard.  The  determination 
of  a safe  flip ht  condit ion  requires  a rapid  check  of  the 
thrust  available,  local  terrain,  and  current  flipht 
parameters.  Generally,  caution  is  necessary  when  at  law 
altitude,  low  airspeed,  and  with  hiph  dram  con f i purnt  ions 
associated  with  land  imp . The  pilot  would  still  receive  a 
warn  i rip  about  the  fire  and  the  applicable  emerp.enev  procedure 
text  as  shown  in  f inure  n . 


KNOT II F FIHF  ( FHFRGKU GY  PI’OCFPilRF  ) 


Throttle  (NO.  ’ ermine)  - I1FTARI.'  (it'  condition: 
perm  i t. ) 

(If  fire  continues)  Throttle  (NO.  ' onpinel  - 
CUTOFF 

Fire  Handle  (NO.  P enpine)  - PHI. I 

Fire  extinguisher  (NO.  enpine)  - OISPFNSF 


F ip. lire 


Enpine  Fire  Procedure  Pisplay 
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pener  <t  r •.  p 1 at:  nor  a , u*  prob  1 etr-so  1 vors  nni'ht  bo  o t oooi 

; [it  t w bro.i.  types . There  are  the  broa.i  prob  1 on  ■"  i vet 

w h.  i o 1 . nook  Vo  find  a general  methodology  applicable  to  a 

0 1 0 *•  p t o I • 1 ems  , Th  i ;;  a pproaoh  baa  rot  k i t •>  rat  per  1 i * 

a 1 1 c c e a , wh.  i oh  ia  not  surpri  s inr.  wlier  t he  nature  o'  the 
ia  examined . An  alternate  approach  usinp  sooeiali.ed 
knowledge  bar.  or.  baa  had  more  demonstrable  rent  it. a.  :’>ero 

1 e p ri  i up  examples  of  specialist  ays  t on  a are  ^ V C ! t It.  • 
i >} , and  ’’ACSV VA  f Id  1 . 

The  nd  hoc  approach  would  seer  n.ost  useful  at  the  p 
time  because  the  aircraft  and  the  fliobt  dome  i :>  nrovide 
natural  centraints  which  can  simplifx  the  plan  oenenatio 
task.  The  r,o«il  is  always  the  same  - to  'and  safely  at  a 
suitable  airfield.  A flipht  plan  and  the  flirht  script 
provide  short  -ranee  no  a Is.  for  the  operation  of  the  urcr 
The  possible  actions  which  can  be  * akon  one  ' imitod  >o 


n 

fix*  !,  Lhouch  l a r p e sot  wh  eh  can  bo  cont  rol  1 ed  , e i i 1 <>r 
direct  ly  or  i rid  i r ec  t ] v , from  (ho  cockpit.  bany  net.  tons  , such 
ns  r pn  i r:  , ht  precluded  because  of  i rincerss  i b i 1 i t y of  system 
coni  po  rents  durinp  flipht.  for  ee , redundnnv  is  commonly  used 
if'  t be  ups  i •>  r of  ni  rernft  systems  which  simplifies  the  proh  1 em 
sol  vinp  i Another  constraint  is  tint  many  controls  are 

binary  - either  a system  or  function  is  PN  or  OFF.  In 
add  it  ion,  most  of  the  interactions  -.to:  >•  t he  systems  of  the 
nircr;  ft  have  been  studied  in  extreme  detail  and  are  well 
tin  lerstuod.  These  oonridernt  ions  will  foe  i 1 i t ate  the  ad  I or 
plan  e r e r a t.  o r . 

An  earlier  airborne  computer  System,  PAPM  ('■?],  which 
involved  the  feneration  of  actions  to  correct  abnormal 
situations  was  limited  in  certain  respects. . While  PA  pv  war 
a b 1 e to  s o 1 v c a lance  class  of  s i mu  1 a fed  mnl fune* ions,  it  w.  s 
not  sensitive  to  chanpes  ir,  context  riurinp  a normal  flipht  . 

The  CAPM  error  correction  procedure  was  developed  by  the  use 
of  a fixed  st  rat  cry . C.APM  assumed  that  t ho  pilot  was  always 
ripht.  and  did  not  interact  constructively  with  the  pilot 
riurinp  the  planninr  stare.  Pence,  CATM  could  not  utilise  the 
pilot's  knovfledce  of  the  aircraft,  and  its  system's,  of 
procedures,  or  of  hip.h  level  coals.  Finally,  if  CAPM  failed, 
it  did  not  provide  the  pilot  adeuuate  information  about  the 
reasons  for  failure. 


L 


The  presence  of  the  pilot  is  else  a consi  rier  etion  that 
must  he  i ncor porated  into  the  desipn  of  an  intelligent 
airborne  computer  system.  The  pilot,  with  his  experience  and 
training,  car,  be  a valuable  source  of  information  durine 
periods  of  abnormal  operation.  For  example,  the  problem  of 
computer  planning  in  incompletely  specified  domains  rA  ] has 
not  really  been  solved.  The  pilot  can  provide  hiph  level’ 
guidance  to  minimize  the  possibility  of  the  computer  system 
becoming  side-tracked.  Pilot  inputs  could  be  the 
specification  of  p.oals,  resolution  of  priority,  resolution  of 
conflicting  information,  or  the  specification  of  current 
limitations.  While  excessive  pilot  dependence  is  not 
desirable,  some  interaction  would  be  of  mutual  veil  tie  to  the 
pilot  and  the  computer  system. 

The  plan  penerator  need  not-  be  able  to  solve  every 
v 

problem'  in  minute  detail.  It  should  do  an  excellent,  job  on 
most  situations,  a reasonable  job  on  most  of  the  other  jobs, 
and  fail  only  partially  on  the  remaining  few  problems.  The 
concept  of  the  use  of  a partial  plan  T F ] emphasizes  the  need 
for  sufficiency  rather  than  detail.  It  must  be  emphasized 
that  a partial  plan  which  may  not  be  adequate  for  computer 
implementation,  may  be  overly  detailed  for  use  by  the  pilot. 
This  is  because  the  pilot  has  much  hipher  level  thought  than 
computer  system.  A partial  plan  may  also  permit  additional 
flexibility  in  a riven  situation  by  allowinr  the  pilot  to 
interpret  the  plan  as  necessary.  For  example,  an  instruct  ion 
to  increase  airspeed  may  be  accomplished  by  a negative  chance 


in  vertical  velocity,  I'V  ir'rensinp  the  cnpine  thrust,  hv 
clump  irtp.  the  con t i r urat  i on  , or  any  comb  i n a t i on  of  the 
pr  coed  i up  met  hod  s . 

Part  ini  plans  concentrate  on  a local  stratepv  1 o revise 
faulty  plat's  at  I In'  fail  point.  This  irt'aris  that  tin'  part  of 
the  plan  that  failed  is  analyzed  to  determine  and  correct  the 
cause  of  failure  and  that  , at  least  t em po r a r i I v , the  rest  of 
the  elan  is  [’reserved.  This  is  usually  more  efficient  than 
scrapinp  an  unsuccess f u 1 plan  in  its  entirety.  furthermore, 
the  reuse  of  old  part ial  plans  can  he  used  hv  the  pilot  to 
evaluate  the  cause  of  the  plan  failure.  The  pilot  ,>r  the  plan 
p.onerator  could  call  for  a chance  in  rlobal  stratepv  when 
local  stratepv  chanpes  appeared  inadequate. 

Once  a plan  is  perorated,  its  execution  could  he 
simulated  hy  us  i np  the  cause-effect  net  . The  simulal  ion  ni  a v 
expose  a fault  in  the  plan  or  an  undesirable  side-effect  . If 
no  unacceptable  side-effects  were  detected  and  the  plan  had 
the  intended  effect,  then  the  pi  .an  could  he  implemented  by  the 
pilot . A plan  to  restart  an  eneine  with  a fai led  fuel  boost 
pump  could  he  tested  by  iisinr  the  net  in  firure  The 

s i mu  I at  i on  would  f o 1 low  the  flow  of  causa  1 i t v and  determine  i I 
the  lesired  coal  was  attained.  If  the  poal  was  not  attained, 
then  the  net  would  provide  information  about  where  the  plan 
failed  by  tin'  inconsistency  ai'ross  a node  mentioned  .hove. 

The  simulat  ion  should  increase  the  success  rate  as  well  as 
con  I i ili  nee  i n t he  pi  an  . 


II 
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The  primary  function  of  1 ho  exeeut  ivo  is  priority 
resolution.  The  exeeut  ivo  r 1 so  controls  1 ho  i n t or  fa  oo  between 
the  pilot  nnd  the  computer.  It  processes  the  pilot’s  coinn'nnds 
am!  (lirootr.  the  mon  i t-or  and  t he  plan  penernt  or  , or  accessor, 
the  knowledge  base.  Furinp  degraded  mode  oporat.ion,  the 
exoi'iit  i ve  insurer,  t hat  t lie  monitor  and  the  plan  pcnornl  or  arc 
operat  inr  on  an  accurate  model  of  the  aircraft..  The 
intelligent  executive  should  also  have  the  capability  to 
determine  when  a task  is  implicitly  delegated  to  it  by  t he 
pilot  . 
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A skilled  pilot  is  able  to  stay  ahead  of  his  aircraft  by 
rapid  i n tor  pro t a t ion  of  his  instruments.  From  practice,  he 
knows  whore  to  look  and  also  what  tv'  expect  to  see.  While 
e on ven 1 i on  a I inst rument at  ion  lends  itself  to  1 hi s type  of 
i nt  orpret at  ion  , mu  1 t i pur  pose  fRT  displays  do  not.  The  pilot 
cannot  look  at  a mult  i purpose  display  and  know  a priori  wh.  1 
will  to  there.  It  could  be  onpine  data,  nnviration  data,  or 


oven 


emergency  data  . 


There  are  two  distinct  interpretations 


that  must,  ho  made,  first,  what,  t tie  informal  ion  is  and  then 
second,  what  it  means.  If  the  handicap  of  the  first 
interpret  at  ion  is  to  he  offset,  then  the  quality  of  t he 
informal  ion  displayed  must,  tie  very  high.  Clearly,  there  is 
more  to  the  problem  than  format  and  organization  factors.  The 
next  section  is  concerned  with  the  content  of  the  information 
provided.  If  the  content  is  not  relevant  , then  no  amount  of 
formatting  or  structure  will  increase  the  value  of  the 
i. n for- ma t ion  . 
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An  example  of  rhrtnpinp  p r i o r i t inn  ran  bn  seen  durinp  t hn 
n or  m;i  1 takeoff  rmunnre . Throuph  1 hn  very  early  port  ot  1 hn 
takeoff  roll,  any  dnviat  ion  may  hn  roportnri  hnnausn  the 
airnrafl  would  bn  I ravnl  inp  a.lowlv  and  would  havn  : m ('  f i n i n n 1 
runway  to  nan i I y atop , However , dnrinp  the  or  i t inal  phono  of 
tala', >11  (iron:  ahonl  1 ('  knot."-  until  pfl  or  takeoff  i 
nomplntnd),  the  executive  .should  ampprnss  anv  information  that 
i a not  rnlatnd  to  takeoff  per  formation  parameter:;,  ,-unh  an 
nnpinn  thrust,  flipht  control  and  flipht  hydranl  i n •u-urnev 

nleotrinnl  power,  1 .and  i nit  rear  ami  brake."  , and  the  inert  i ■! 
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certain  posit  ion,  lie  will  see  a certain  t.vpp  of'  informal  ion. 

As  petitioned  earlier,  the  content  of  the  information  is 
of  primary  importance.  however,  the  orpanizat  ion  of  the 
material  is  also  worth  commentinp  upon.  If  we  assume  that  the 
basic  display  layout  to  ho  somewhat  as.  pictured  i ti  fipuro  b , 
the  MPDs  could  be  pi  von  an  arbitrary  rankinp.  For  example, 
MI’D-I  eould  be  the  display  whieh  always  displays  the 
information  that  is  eonsidered  most  important  by  the  computer 
system.  Ml’!'-.1  mipht  have  the  next  most  important  informal  ion. 
The  pilot  could  easily  determine  his  perioral  situ.at  ion  bv  a 
very  rapid  and  compart  scan.  Supplement  al  inform.at  ion  eould 
be  provided  on  Mi’ll- 1 and  MI'P-'I. 

The  Vortical  Situation  Display  (VSP)  should  include  not 
only  attitude  and  pitot  stat  ic  informal  ion,  but  also  etipitK- 
thrust  and  projected  flipht  oath  ir format  Lon.  The  Head-lip 
Display  (HDD)  should  present  the  same  informal  ion  .s.  the  VSi'. 
The  primary  difference  would  bo  1 lit'  bad;  pround  arnitist  which 
it.  is  presented.  The  HIIP's  hack  (’round  would  be  the  natural 
visual  scene  out  the  front  for  the  aircraft  . The  VSP's 
back  (’.round  would  be  computer  potior  at  ed , infra-red  i marine,  or 
radar  profiles  of  terrain.  The  Porisont.nl  Situation  Display 
(USD)  would  provide  flexible  i n format  ion  and  format  t ire. 
depend  inp.  upon  the  oont.ext  . Typical  information  would  inelude 
terrain  topography,  airfield  locations,  si  pn  i I’i  cant  traffic, 
and  course  inferm.it  ion.  Supplemental  informal  ion  eould  be 
made  avail  aide  depend  Ini',  upon  the  phase  of  flipht  . Other 
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information  which  would  be  useful  durinp  takeoff  would  include 
an  aircraft  performance  far  t or  (sea  1 o of  ('  t<>  t.n  tel, it  i ve  1 < 
optimal  acceleration),  distance  to  liftoff,  distance  to  stop 
(if  takeoff  is  aborted),  and  runway  remain  inf-  • Once  safely 
airborne,  the  script  would  chance  and  a new  priority  rank  i nr. 
would  come  into  effect. 

H ,2  Pepraded  bode  Operation 

The  degraded  mode  operat  ion  is  inherent  with  a condit  ion 
sensitive  monitor  inr,  system.  Since  the  condition-based 
context  will  affect  the  priority  and  act  ion,  a separate  nodal 
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ponerator.  If  reflects  the  monitors  sensit  ivitv  t.o  the 
degraded  mode  model  of  the  aircraft. 

Besides  chances  in  hand  line,  systems,  other  ehanpes  are 
probable  in  a degraded  operation  of  the  aircraft  . Lower 
performance  is  common.  The  flipht  nlnn  must  be  reviewed  and 
necessary  revisions  made  to  reflect  the  depended  eapabilil ies 
of  the  aircraft.  If  an  emergency  landinr  is  anticipated  the 
necessary  prepar.it  ions  should  he  made.  These  mi  chi  include  a 
revised  landing  procedure,  chanrinc  course  to  a closer 
airfield,  oonservat  i on  measures  for  fuel  or  other  consumables, 
or  re  lay  inp.  the  necessary  information  to  the  radar  cent feller 
for  coord i nat  i > n . 
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M . ' 1'vnarn  i e Task  A 1 I ooat  ic  i 

The  workload  of  t ho  pilot  is  novor  const  out  and  nn 
intol  lipent  onboar  i computer  system  should  ho  able  to  assist 
i.’i  thout  hovinp  to  ho  asked.  An  example  mipht  ho  a descent  to 
land  wit*  a.  i nt.ermed  i at.o  altitude  restriction  because  of  hi  ph 
t i’jt.i  in . It  the  pilot  did  not  ho  p i it  his  level  off  hy  'he 
normal  lead  point  , t hi'  computer  system  would  respond  hv 
providin'  a warn  ini’.  If  t ho  pilot  did  not  respond  to  the 
warn  i tie  , then  the  computer  system  would,  after  a reasonable 
interval,  enpape  the  autopilot  and  onuso  the  plane  to  level 
off  at  the  proper  altitude.  The  pilot  would  have  three 
dist  inot  opport un i t i es  to  prevent  or  override  the  computer 
system,  First  , he  could  have  started  the  level  off  at  or 
before  the  normal  lead  point  and  avoided  the  warning.  Second, 
he  could  have  responded  to  the  warn i nr  by  start  inp  to  level 
off,  hy  speeifyinp  a ehanpe  to  the'  altitude  clearance  in  the 
computer,  or  simply  eomnandinp  the  computer  to  "st and  hy". 

The  last  response  by  the  pilot  would  prevent  the  computer  from 
enpapi  np  the  autopilot  in  an  attempt  to  levol  off  at  the 
clearance  altitude,  hut  not  from  issuinp  i further  warn i nr 
niessape  it’  necessary.  Thirdly,  the  pilot  could  override  the 
autopilot  and  resume  normal  control.  This  soouenee 
demonstrates  protect  ion  apainst  both  computer  malfnnet  ion  and 
pi  lot  error . 
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Task  allocation  requires  an  extensive  array  of 
information  in  order  to  be  effective.  The  information  would 
include  script  and  flight,  plan  data  on  which  to  base  the 
nominal  conditions  as  well  as  the  current  flight  clearance. 
The  condition  of  the  aircraft  must  he  known  to  determine  what 
limitations,  should  be  imposed  upon  the  aircraft.  For  example 
an  aircraft  with  an  enpine  out  would  have  performance 
limitations  such  as  turns  into  the  f a i led  enpine,  lower  rate 
of  climb  and  cruise  altitude,  and  significantly  reduced  low 
s.peed  per  formance  . 
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The  basic  function;'!  entities  .sharp  a c 
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n . I Scripts 

Phase-based  context  information  is  char 
rout  ine  nature.  This  t \ po  of  inform. at  ion  ca 
Scripts.  A script  is  o "structure  that  dose 
appropriate  sequence  of  events  in  a pr.rticul 
It.  is  a mundane,  stereotyped  seuuence  for  a 
s i t- un  t i on  . It  can  provide  default  informati 
expedite  certain  processes.  I n addition  tv' 
the  present  context,  it  can  provide  informat 
context.  For  example,  we  normally  anticipat 
will  follow  the  cruise  and  that  a descent  wi 
land  inf.  The  following  scripts  prv'vivlc  a sa 
of  a flifht  script.  The  hiph  level  script  i 
1 ike  a tree  structure,  the  lower  levels  beoo 
detail ed  . 

The  entry  conditions  arc  not  mandatory 
which  must  he  sat isfied,  but  arc  euides  whic 
script  should  he  entered.  The  t rarsi t ions  i 
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al  t.ornnt  i ves  a v a i 1 ah  ] e . Tt  ■ transition  script  with  t he 
closest  mat.ehi  nr  entry  conditions  would  t'e  the  lil:elv 
candidate  for  the  followinp  script.  For  example,  if  durirp 
script  A.  elide  slope,  the  selection  of  tie  next  script 

would  he  either  script  A . T , flare,  or  script  A . r' , 
p.  o- or  ound/tr  i ssed  approach  . The  actual  conditions  of  the 
aircraft  would  determine  which  script  should  he  selected, 
pilot  would  he  able  to  override  the  corput.er  selection  of  . 
s cr i rt  . 


h .1.1  Top  Level  FI  ip  tit  Script 


1.  Preflipht.  Ope  rat.  ions 

1.1  F 1 i p h t I'l  a : n i nr. 

1 . !'  r e f 1 i v h t Checkout 

1 . ' Tax  i 

?.  Takeoff 

. 1 line  1 1 p 
?.?  Takeoff  Roll 
? . ' After  A i r borne 
. A Departure 
S.F  Aborted  Takeoff 

1 . Knrout  o 

' . 1 ('limb 
1 . P fruise 
i.P  Descent 

. 1 arid  i tip 

A.1  Approach  to  Field 
A . P Final  Approach 
I I.x  Flare 

A . A Touchdown  nnA  Rollout 
A.1'  do-  around  /Vi  ssed  Approach 

ri . Fostflipht  Operations 

h .1  Taxi 

s . 0 Post. flipht  Checkout 
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Presort  in  forint  ion  to  pi  1 of  or  r>:  . 

n . 1 . ' Monit  or  n av  i p at  ion  to  the  final  pproi  :1 

fix. 

‘.'or mol  transit  ior  : - >■  i p t ;i . , . 

Alternate  transitions;  Script  . S , Script  ? 

Final  Approach 

I'ntrv  conditions:  Script  'PI;  hear  * ho 
final  approach  fix. 

intercept  the  final  approach  course 
i n hound . 

Insure  land inp  system  radio  sicnnl  is 
reliable. 

Confirm  land inp  clearance. 

t . ' . Clide  1 ore 

Intercept  elide  slope. 

Establish  1 a n c!  i n p c o n f i p u r a t.  i o n . 

Maintain  the  plide  slope  nnd  final  approach 
t'v  nr  so  . 

Maintain  recommended  approach  ancle  of 
a t t ac k . 


Normal  transition:  Script  'i . ; . 

A 1 1 c r n a t c t r a n s i t i o n : S e r i r t.  J> . s . 


Flare 


« . 3 


Entry  conditions:  Script  4.2;  Aircraft  is 
at  the  f 1 ar e point. 

4.3.1  Decrease  rate  of  descent. 

4.3.1  Decrease  airspeed. 

4.3.3  Maintain  runway  alignment. 

Normal  transistion:  Script  4.4. 

Alternate  transition:  Script  4 . g . 

4.4  Touchdown  and  Rollout 

Entry  conditions:  Script  4.3;  Aircraft  on 


the 

runway 

• 

4 . 4 

. 1 

Check 

thrust  at 

idle' 

4 . 4 

. 2 

Lower 

nosewheel 

to  runway 

4 . 4 

. 3 

Begin 

b r a k i n g a s 

requ i red 

Apply  reverse  thrust. 

Extend  spoilers. 

Apply  wheel  brakes 

4.4.4  Turn  off  runway. 

Normal  transition:  Script  5. 

Alternate  transitions:  Script  4 . 5 , Script 
2.2,  Script  2.1.. 

4.5  Go-Around/Missed  Approach 

Fntry  conditions:  Script  4;  Excessive 
deviation  of  altitude,  airspeed,  course,  or 
glide  slope;  Want  to  execute  a missed 
approach. 

4.5.1  Set  throttle  at  takeoff  power. 

4.5.2  Configure  for  go-around. 

Set  flaps  for  go- around. 

Raise  landing  gear  (if  aircraft  is  climbing). 

4 . 5 . 3 Follow  missed  approach  instructions. 

Climb  to  missed  approach  altitude. 

Maintain  missed  approach  course. 

Normal  transition:  Script  4.1. 

Alternate  transition:  Script  2. 


li . 1 . t Priority  Chances  Puri  up  Different  foripts 

The  script  enn  provide  in  format  ion  about  priorities 
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of  cabin  pressurization  is  very  serious  and  reouires  immediat< 
net  i mi . The  :.;inie  problem  durinp  takeoff  would  not  be 
critical.  The  computer  must  be  aware  of  chnnpes  in  context  t. 
provide  maximum  assistance  to  the  aircrew.  The  relot  ive 
priority  of  certain  situations  may  he  determined  in  part  by 
t he  phase-based  context.  The  script  can  provide  a priority 
structure  for  common  situations  in  the  form  of  a list  . The 
basic  areas  of  the  list,  would  be  divided  bv  the  normal  flit'll 
operations  informat  ion.  For  example,  a 1 ist  of  priorit  it  s for 
1 and  i iif.  inif.ht  be  someth  inf  like  the  followinp  list  . t ot  e that 
durinp  the  cruise  script,  all  rieviat ions  arc  o f h if her 
priority  than  normal  operations,  which  has  been  ■ el 
arbitrarily  to  a priority  of  four. 


. ? Cnuse-K  ffoet-  Nets 


Tito  condition-based  context  reflect  s the  state  of  the 
aircraft  end  its  systems.  Previous  exnmples  of  the  condition 
sens  it  ivity  were  the  f'n  i lure  of  the  second  generator,  the 
chance  in  normal  state  during  fuel  transfer,  and  the  engine 
flare -out  caused  hv  the  mn  1 f uno  t ion  i nr  fuel  boost  puirn.  Part 
of  this  information  can  be  represented  as  a cause-ef feet,  net 
ns  depicted  in  fipure  ?,  which  utilizes  a representation  based 
upon  the  (lommon-Sense  Alporilhm  111,  PM.  This,  net  can 
provide  cause-effect,  relat  ions  between  system  components  and 
their  respect  i vc  states.  It  can  a 1 so  represent  the 
relationship  amoni',  hirh  level  systems.  Kxternal  or 
environmental  context  is  char  aeter  i z.ed  by  its  relative 
independence  of  the  aircraft  and  phase  of  f 1 ieht  . The  pr i mar y 
factor  is  the  weather.  The  representation  of  the  external 
context  can  also  he  represented  in  the  form  of  a cause-ef feet 
net  . This  not  should  be  independent  of  the  previously 
discussed  condition-based  context  relations  because  the 
external  context  is  likely  to  chanpe  unite  often. 


b . T Real-Time  lint. a 


.1.1  Sensor  Data 


An  extensive  net  work  of  sensors  would  be  needed  to 
provide  the  monitor  with  the  necessary  data.  The  sensor 
network  would  probably  use  distributed  proeessers  to  increase 
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AM  of  t tie  sensors  ior  a related  system  would  be 
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channeled  through  a preliminary  processing  stare  which  would 
only  forward  data  which  was  a change  from  the  previous  state 
or  if  a certain  interval  of  time  had  passed  without,  a report. 
This  first-  stare  processinp  would  use  a very  low  level  model 
to  verify  the  sensor  output.  After  the  first  stare  of 
processinp,  the  data  would  po  to  a data  acquisition  unit  which 
would  receive  verified  sensor  data  from  the  first  shape 
processors  of  related  units.  These  data  acquisition  units 
would  use  a hipher  level  model  apuinsh  which  to  verify  sensor 
data.  Here  apain,  to  reduce  bus  communications  requirements, 
processed  data  would  not  be  forwarded,  unless  a ehanpe  were 
detected  or  a certain  interval  of  time  had  passed  without  a 
repor  t. . 

b . 1 . ? Pat a I , i nk 

The  data  link  reduces  the  need  for  t.he  pilot  to  feed 
information  to  t lie  computer  system,  while  providing  real-t  i me 
information  to  the  computer.  The  data  link  will  provide 
information  that  is  not  available  from  the  onboard  sensor 
system  or  from  the  onboard  knowlodpe  base.  This  would  include 
flipht  clearance  information  for  chanpes  in  flipht  level, 
speed,  or  rout. inp.  Another  important  type  of  information  that 
would  he  available  would  be  onrouto  and  destination  weather. 
Other  information  mirht  include  detailed  terrain  elevations, 
traffic,  and  alternate  airfield  data  for  the  current,  flipht 
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The  future  use  of  airborne  computer  systems  seems 
certain.  Sufficient  emphasis  must  be  placed  upon  insuring 
that  the  design  of  future  systems  make  maximum  use  of  existing 
technology . The  concepts  developed  in  the  area  of  artificial 
intelligence  can  have  a profound  impact  on  the  capabilities  o] 
advanced  computer  systems.  In  this  thesis,  it  has  been  arpuee 
that,  an  intelligent  airborne  computer  system  can  enhance 
flight  safety  by  reducing  the  pilot's  workload  by 

1.  assuming  the  primary  monitoring  function  and 
thereby  relieving  the  pilot,  of  this  tedious, 
time-consuming,  but  simple  task, 

providing  plans  to  assist,  the  pilot  cope  with 
abnormal  situations  as  well  as  normal 
ope rat  ions , 

■i . prioritizing  information  so  as  to  not  inundate 
the  pilot  with  information  and  especially 
irrelevant  information . 

The  intelligence  of  the  computer  system  i s based  upon  it: 
sensitivity  to  context.  The  context  information  in  the 
knowledge  base  is  based  upon  scripts  and  cause-effect  nets. 

The  scripts  provide  context  for  each  part  icular  phase  of 
flight.  The  cause-effect  nets  provide  context  based  upon  the 
eondit  ion  of  the  aircraft,  and  its  environment  . The 
intelligent  airborne  computer  system  frees  the  pilot  of 
trivial  tasks  to  perform  the  high  level  management  of  the 
a i rcr a ft . 
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